Lib superagent:8.0.9 has dependency with problems about chai-http HOT 8 CLOSED

This PR might fix it or can be used for further fixes @keithamus - #317

from chai-http.

I'll close as this is resolved in #317 but we'll likely need to release this as breaking.

from chai-http.

Seems the tests don't pass when updating superagent to the latest version. Possibly related to this.

ladjs/superagent#1793

  2 failing

  1) assertions
       #cookie (agent):
     TypeError: Cannot read properties of undefined (reading 'push')
      at Agent.<computed> [as set] (node_modules/superagent/lib/agent-base.js:20:20)
      at Context.<anonymous> (test/http.js:378:13)
      at process.processImmediate (node:internal/timers:478:21)

  2) request
       Node.js
         agent can be used to persist cookies:
     TypeError: Cannot read properties of undefined (reading 'getCookies')
      at TestAgent._attachCookies (node_modules/superagent/lib/node/agent.js:75:30)
      at TestAgent.<computed> [as get] (lib/request.js:220:404)
      at Context.<anonymous> (test/request.js:192:10)
      at process.processImmediate (node:internal/timers:478:21)

from chai-http.

Dependabot cannot update formidable to a non-vulnerable version

The latest possible version that can be installed is 2.1.2 because of the following conflicting dependencies:

[email protected] requires formidable@^2.1.2 via [email protected]
No patched version available for formidable

The earliest fixed version is 3.2.4.

Dependabot note about this

from chai-http.

PRs welcome!

from chai-http.

in chai-http in particular, i suspect its because superagent now wraps Agent in a proxy

so this line:

doesn't do what it looks like it does. it looks like its trying to call the super constructor, but it will actually call superagent's Proxy function which returns the instance (i.e. it won't mutate this)

tbh maybe chai-http just needs a modernisation in a major release - turn all the prototypes into classes, etc

from chai-http.

turn all the prototypes into classes, etc

You may well be right. But to be honest, I just want to stop my npm install to stop yelling at me about 'critical' vulnerabilities. 😬

from chai-http.

yeah i get that. unfortunately, superagent doesn't export the underlying Agent class for us to new up

they kinda borked things with that Proxy here:
https://github.com/ladjs/superagent/blob/b368f62b3d9beae564e8dca1eb1969fc7d10580e/src/node/agent.js#L102-L110

means it will new one up but unbound, i.e. not bound to thisArg

from chai-http.